CSV Escape Formatter
Quote CSV fields, double embedded quotation marks, and preserve commas, line breaks, and boundary whitespace.
Input Interpretation
Escaped Output
Quoted CSV field output will appear below.
Escaped CSV fields will appear here.
Escaping a field is different from parsing a CSV file
A CSV row is made from fields separated by commas. The hard part is that a comma, quotation mark, or line break can also be part of a field's data. RFC 4180 documents the widely used convention: fields containing commas, double quotes, or record line breaks are enclosed in double quotes, and a double quote inside a quoted field is written twice.
The input model works one level lower than a CSV parser. Give it raw field values and it produces escaped field text. It does not split an existing row into columns, infer a header, validate equal column counts, or repair a malformed CSV document. In line-by-line mode, each physical input line is deliberately treated as a separate field; switch to one-field mode when the value itself contains line breaks.
Reference: RFC 4180 — Common Format and MIME Type for CSV Files. RFC 4180 is Informational rather than an Internet Standard, which matters because spreadsheet and database applications still have dialect differences.
What changes when a field is written to CSV
| Raw field | Escaped field | Reason |
|---|---|---|
| Pune, India | "Pune, India" | The comma must stay inside one field. |
| He said "hello" | "He said ""hello""" | Embedded quotes are doubled inside the quoted field. |
| A value containing a line break | One quoted field spanning that line break | The record boundary must not be confused with field data. |
| value | " value " | Boundary whitespace is quoted here as a compatibility choice. |
RFC 4180 says spaces are part of a field and should not be ignored; it does not require quoting merely because spaces appear at an edge. Boundary whitespace is quoted conservatively here because import tools sometimes trim unquoted values.
CSV quoting does not make spreadsheet formulas safe
Spreadsheet applications can interpret cells beginning with characters such as=,+,-, or@ as formulas. Correct CSV quoting protects the CSV structure, but it is not a universal formula-injection defense. The formatter therefore warns rather than silently prefixing a character that would change your data. Exports containing untrusted values need a mitigation chosen for the spreadsheet applications and downstream consumers that will open them.
Security guidance: OWASP — CSV Injection.
Record boundaries and importer differences still belong to the destination
- Line endings: line-by-line output uses CRLF, the record separator documented by RFC 4180. One-field mode keeps line breaks as field data and quotes the value.
- Empty fields: an empty line becomes
""so the empty field is visible instead of disappearing in copied output. - Other delimiters: semicolon- or tab-separated files are different dialects. Only comma-separated CSV rules are applied here.
- Character encoding: the browser preserves the JavaScript text you enter. The encoding used when you later save a file—normally UTF-8 in modern systems—is a separate file-writing decision.
Escaping is performed in the browser by this component; the field values are not sent to a conversion endpoint.